chore(memory-bank): plan the live tests before 5.0.0

- activeContext: the maintainer decided to run live tests of 5.0.0-rc4 in
  a lab before 5.0.0, on another workstation with his lab script; the four
  cases that no local test covers (#34 and the audit cmdlets over SMB,
  effective access with domain accounts and -ServerName, orphaned entries
  of a deleted domain account), against rc2 as the baseline and rc4; the
  tester feedback on IBM ESS expected in #34.
- progress: 5.0.0 waits for the live tests and the #34 feedback.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: AI Assistant <ai@example.com>

.memory-bank/activeContext.md

@@ -9,24 +9,27 @@ source: current task evidence
 
 ## Current focus
 
-5.0.0-rc4 is released and recorded. Next is 5.0.0, when the maintainer
+Live tests of 5.0.0-rc4 in a lab, which the maintainer decided on
-decides; then the repository is archived in favor of WindowsAccessControl
+2026-10-06 to run before 5.0.0. He continues on another workstation that
-(Decision 18). Issue #34 is open with Bug and Help Wanted; a user there
+has his lab script. 5.0.0 waits for these results and for the tester
-planned to test 5.0.0-rc3 against an IBM ESS file server.
+feedback in #34; then the repository is archived in favor of
+WindowsAccessControl (Decision 18).
 
 ## Evidence
 
-- 2026-10-06: the tag `5.0.0-rc4` on `01d9264`, the merge commit of #113,
+- 2026-10-06: 5.0.0-rc4 is published from the tag `5.0.0-rc4` on
-  published the prerelease to the PowerShell Gallery and to GitHub. The
+  `01d9264`, the merge commit of #113, and verified from the Gallery
-  Gallery package and `NTFSSecurity.zip` hold identical module files; the
+  package in both editions; its issues are closed (progress).
-  package imports as 5.0.0-rc4 in both editions and passes the smoke tests
+- The Pester tests run only on standalone machines against local NTFS
-  of #41 and #34. CI passed for #113 and on `master`.
+  folders, with local and well-known accounts. No test uses a UNC path, a
-- The rc4 replies are posted: #41, #108, #109, and #111 are closed as
+  share, a domain account, or `Get-NTFSEffectiveAccess -ServerName`, which
-  completed, #90 and #107 got WontFix and are closed as not planned. The
+  calls `AuthzInitializeRemoteResourceManager` over RPC. 5.0.0 changed no
-  findings that the rc4 review deferred are listed in #113.
+  code that is specific to domains or SMB.
-- Without the Security privilege, the tests that change the audit entries
+- In #34, the tester wrote on 2026-10-06 that the owner problem also exists
-  of a descriptor from `Get-NTFSSecurityDescriptor` skip; a basic-user run
+  on their IBM ESS system, and that he reports rc3 results against both
-  fails only the `Enable-Privileges -PassThru` count test (techContext).
+  their file servers on 2026-10-07. No lab reproduces IBM ESS.
+- The second workstation has Hyper-V and AutomatedLab 5.61, but no
+  LabSources folder, ISO, or lab.
 - Hand commands to the maintainer as fenced code blocks at the end of the
   reply, and end the turn there; never put them in the question dialog,
   which also covers a reply before it. A pull request names an issue
@@ -34,5 +37,19 @@ planned to test 5.0.0-rc3 against an IBM ESS file server.
 
 ## Next step
 
-Before 5.0.0, read #34 for feedback from the tester. Then release 5.0.0 as
+Build the lab with the maintainer's script: a domain controller, a file
-`progress.md` describes.
+server with a share, and a client. From the client, run live tests against
+5.0.0-rc2 as the baseline and 5.0.0-rc4, in Windows PowerShell 5.1 and
+PowerShell 7:
+
+1. #34 over SMB: a domain user who isn't an admin on the file server, with
+   Full Control on a share folder owned by Administrators, runs the access
+   and inheritance cmdlets on its UNC path. rc2 should fail with (1307);
+   rc4 should succeed and keep the owner.
+2. The audit cmdlets over SMB, where the file server, not the client,
+   checks the Security privilege: as a user with and without it there.
+3. `Get-NTFSEffectiveAccess` for domain accounts with nested groups, and
+   with `-ServerName`.
+4. `Get-NTFSOrphanedAccess` with the entry of a deleted domain account.
+
+Then, with the #34 feedback, release 5.0.0 as `progress.md` describes.

.memory-bank/progress.md

@@ -70,8 +70,9 @@ soon; its users move to WindowsAccessControl (Decision 18).
 
 ## Open work
 
-1. Release 5.0.0 through CI (Decision 12) when the maintainer decides:
+1. Release 5.0.0 through CI (Decision 12) after the live tests in a lab
-   remove the label, date `[Unreleased]` as `[5.0.0]`, add `5.0.0-rc4` to
+   (`activeContext.md`) and the tester feedback in #34: remove the label,
+   date `[Unreleased]` as `[5.0.0]`, add `5.0.0-rc4` to
    `$publishedVersions`, and tag `5.0.0` (steps in
    `Docs/Contributing/05-Releasing.md`). #34 stays open with Bug and Help
    Wanted until a tester with a file server that refuses the owner